[HEIMDAL-533] KDC sends TGS-REP encrypted in session key not authenticator

[HEIMDAL-533] KDC sends TGS-REP encrypted in session key not authenticator

From RFC 4120, page 35

   In preparing the authentication header, the client can select a sub-
   session key under which the response from the Kerberos server will be
   encrypted.  If the client selects a sub-session key, care must be
   taken to ensure the randomness of the selected sub-session key.

The client library alread handle this case.

Thanks to Sam Hartman to report this though Debian